Описание
Security update for libxml2
This update for libxml2 fixes the following issue
- CVE-2026-11979: stack-based buffer overflows in the
xmlcatalogutility when running in--shellmode (bsc#1269790).
Список пакетов
Container suse/manager/4.3/proxy-httpd:latest
Container suse/sle-micro-rancher/5.3:latest
Container suse/sle-micro-rancher/5.4:latest
Container suse/sle-micro/5.3/toolbox:latest
Container suse/sle-micro/5.4/toolbox:latest
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise Micro 5.3
SUSE Linux Enterprise Micro 5.4
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
Ссылки
- Link for SUSE-SU-2026:3095-1
- E-Mail link for SUSE-SU-2026:3095-1
- SUSE Security Ratings
- SUSE Bug 1269790
- SUSE CVE CVE-2026-11979 page
Описание
libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell() function processes user input using fixed-size stack buffers without proper bounds checking. By supplying an overly long input line, an attacker can overflow internal buffers (command, arg, and argv) during input parsing. This results in memory corruption within the stack frame. Successful exploitation may cause a crash or potentially allow arbitrary code execution in the context of the xmlcatalog process. This issue has been fixed in the commit c2e233fc. NOTE: The maintainers of this project did not agree that this issue is a vulnerability and considered it a bug.
Затронутые продукты
Ссылки
- CVE-2026-11979
- SUSE Bug 1269790